v1.0.0

Ai Video Generation

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:12 AM.

Analysis

This is a coherent AI video-generation CLI skill, with the main cautions being that it installs an external Node CLI and uses a service API key that may spend account credits.

GuidanceThis skill appears appropriate for AI video generation. Before installing, make sure you trust the ai-media-generator package, use a dedicated API key, and approve any video-generation command that could spend account credits.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

ricebowl.ai
  -> recharge credits
  -> create API key
  -> set key
  -> models show --model <MODEL>
  -> choose text-to-video or image-to-video
  -> video generate

The workflow is purpose-aligned, but it includes actions that can use an external account and paid generation credits.

User impactIf the agent runs a generation command, it may create paid API usage on the user's video-generation account.

RecommendationConfirm the selected model, duration, prompt, and expected cost before allowing video generation commands to run.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

install spec

node | package: ai-media-generator | creates binaries: ai-media

The skill depends on an external Node package to provide the CLI, while the supplied artifact set contains only SKILL.md and no package code.

User impactInstalling the skill will rely on code from the external package source rather than code visible in these artifacts.

RecommendationInstall from a trusted registry/source and review or pin the package version if supply-chain assurance is important.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

requires:
      env:
        - AI_MEDIA_BASE_URL
        - AI_MEDIA_API_KEY
...
ai-media config set-key <KEY>

The skill requires and configures an API key for the external service. This is expected for the stated purpose, but it is still account authority.

User impactAnyone with the configured API key may be able to use the associated video-generation service account within the key's permissions.

RecommendationUse a service-scoped API key, avoid pasting secrets into shared chats, and rotate the key if it is exposed.